CVE-2026-97231CWE-287CWE-306

CVE-2026-97231

High · published September 24, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
31.2
In the wild
Unconfirmed
What it is

A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The manipulation results in missing authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00383 · 31.2th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-09-24T21:17Z
References (5)
https://note-hxlab.wetolink.com/share/y74Vzt1jfkAi · [email protected]https://vuldb.com/cve/CVE-2026-97231 · [email protected]https://vuldb.com/submit/908265 · [email protected]https://vuldb.com/vuln/409321 · [email protected]https://vuldb.com/vuln/409321/cti · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 16:45Z
    volotat Anagnorisis Socket.IO Connect app.py missing authentication
    cvelistv5